Security & Trust

This page consolidates everything about how Lore DB handles your data, who can access it, and what guarantees we provide.

At a glance

What goes to OpenAI

When you use Search, Ask AI, or save a document, content is sent to OpenAI’s API:

• Document saves: Content is sent for embedding generation (text-embedding-3-small, 1536 dimensions)
• Search queries: Your query is sent for embedding
• Ask AI: Retrieved document chunks + your question are sent for answer generation

What is NOT sent to OpenAI: Your email, name, profile picture, library names, team membership, billing info, or any account metadata.

OpenAI’s data policy

We use the OpenAI API, not ChatGPT. Per OpenAI’s API data usage policy:

• API data is not used to train OpenAI models
• Data is retained for 30 days for abuse monitoring only
• After 30 days, data is deleted from OpenAI’s systems

Bring Your Own Key (BYOK)

If your organization requires a direct contractual relationship with OpenAI, you can provide your own API key in Settings. When using BYOK:

• All AI requests go directly through your API key
• OpenAI’s enterprise data policies apply to your account
• You have full control over your OpenAI data retention settings

Encryption

In transit

All communication uses HTTPS/TLS. There is no unencrypted HTTP endpoint.

At rest

• Database: AES-256 encryption provided by Supabase (PostgreSQL)
• API keys: Encrypted with Fernet symmetric encryption before storage
• Embeddings: Stored as pgvector arrays in the encrypted database
• Backups: Encrypted by Supabase infrastructure

Authentication & access control

Authentication

• Google OAuth only — we never see or store passwords
• Two-factor authentication is handled by your Google account
• Session management — secure HTTP-only cookies
• MCP connections use the same authentication system

Role-based access

Access is checked on every request. There is no caching of permissions.

Systems

Systems group libraries together. A system membership grants access to all libraries within that system, simplifying organization-wide access management.

Data residency & infrastructure

The application runs as stateless serverless functions on Vercel. There is no persistent server — each request is independent. This means there is no server to compromise and no session state to leak.

Data portability & lock-in

• Export: Any library can be exported as a complete JSON file containing all document titles, content, and metadata
• Import: Libraries can be imported from JSON, including community-shared libraries
• Delete: Individual documents can be deleted immediately. Full account deletion available on request.
• No proprietary formats: Documents are stored as Markdown. Embeddings are standard OpenAI text-embedding-3-small vectors.

GDPR compliance

Lore DB supports the following data subject rights:

• Right of access — View all your documents, libraries, and usage in the app
• Right to portability — Export any library as JSON
• Right to rectification — Edit any document you own
• Right to erasure — Delete documents immediately; full account deletion on request
• Right to restriction — Toggle libraries inactive to exclude them from AI processing

Data Processing Agreement

If your organization requires a DPA for compliance, we provide a standard DPA covering:

• Data processing scope and purpose
• Sub-processor list (Supabase, Vercel, OpenAI, Stripe, Google)
• Data subject rights procedures
• Security measures and breach notification

Contact us through the app to request a DPA.

What we do NOT do

• We do not store passwords (Google OAuth only)
• We do not use your data to train AI models
• We do not share your documents with other users (access is role-based)
• We do not log document content (only metadata: operation type, token counts, timestamps)
• We do not sell your data to third parties
• We do not allow unauthorized access — every request is authenticated and authorized

Data retention

Community libraries

Any library owner can publish their library to the community. Before publishing, users must acknowledge responsibility for their content and confirm compliance with the Terms of Service.

• Publisher responsibility: Publishers are solely responsible for the content they share. Lore DB does not review or endorse user-published content.
• Acknowledgment required: A mandatory acknowledgment step before publishing confirms the publisher understands their responsibilities.
• Reporting mechanism: Any user can report a community library they believe violates the Terms of Service. Reports are reviewed by Lore DB administrators.
• Moderation: Administrators can unpublish any library that violates the terms. Libraries published by administrators are attributed to “Lore DB.”
• Publisher visibility: Your name is shown publicly on libraries you publish.
• Copyrighted content: Publishing paywalled or copyrighted content is prohibited. Users can store such content in private libraries if they hold valid licenses.
• Private libraries: Users can create private libraries with any content for their own team’s use.

See Community Publishing Rules for full guidelines.